Oct 23 2017

Oracle Java, ruleset.xml and signing deploymentruleset.jar

image_pdfimage_print

Since Java 7 Update 51 Oracle has tighten the Java security. From now on only predefined sites are allowed to run, otherwise users will get all kind of warnings.
Fortunately the most warnings can be suppressed. In this article I will describe what admins can do.

Fortunately Oracle has described what can be done:

  1. Introducing Deployment Rule Sets
  2. Deployment Rule Set

The following steps need to be performed:

  1. Create a ruleset.xml
  2. Create a DeploymentRuleSet.jar from the ruleset.xml
  3. Sign the DeploymentRuleSet.jar with a self created certificate
  4. Copy the signed DeploymentRuleSet.jar, deployment.properties and deployment.config files to %windir%\sun\java\deployment.

The steps in detail:

In this example I will use Java 8 Update 151. That was the most recent version at the time of writing this article.

  1. Download Java JRE 8 Update 151 (offline installer) from Java Downloads for All Operating Systems.

    jre-8u151-windows-i586.exe

  2. Download Java JDK as the same version as the Java Runtime Engine from Java SE Development Kit 8 Downloads.

    jdk-8u151-windows-i586.exe

  3. Use 7Zip to extract the content of the file jdk-8u151-windows-i586.exe. You will get a ‘tools.zip’ folder.
  4. Extract the following files from the tools.zip file and copy them to a new folder:
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    
    Folder PATH listing for volume Windows
    Volume serial number is 00000072 D689:C60A
    << Folder does not matter >>
    +---bin
    |       jar.exe
    |       jarsigner.exe
    |       jli.dll
    |       keytool.exe
    |       msvcr100.dll
    |       ruleset.xml
    |       
    \---lib
            tools.jar
  5. Create the ruleset.xml in the ‘bin’ folder (this one is an example grabbed from the Oracle Website):
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    26
    27
    28
    29
    30
    31
    32
    33
    34
    
    <!-- Example Deployment Rule Set that allow a desktop administrator to control end-user's execution of browser applets.
         See http://docs.oracle.com/javase/7/docs/technotes/guides/jweb/security/deployment_rules.html -->
    <ruleset version="1.0+">
     
      <rule> <!-- allow anything signed with company's public cert --> 
        <id>
          <certificate hash="794F53C746E2AA77D84B843BE942CAB4309F258FD946D62A6C4CCEAB8E1DB2C6" />
        </id>
        <action permission="run" version="SECURE" />
      </rule>
     
      <rule>
        <id location="*.example.com" />
        <action permission="default" />
      </rule>
     
      <rule>
        <id title="Solitaire" location="https://host.example.com/games" />
        <action permission="run" />
      </rule>
     
      <rule>
        <id location="https://host.example.com" />
        <action permission="run" version="SECURE-1.7" />
      </rule>
     
      <rule>
        <id />
        <action permission="block">
          <message>Blocked by corporate. Contact J. Smith, smith@host.example.com, if you need to run this app.</message>
        </action>
      </rule>
     
    </ruleset>
  6. Install Java 8 Update 151
  7. Run the following commands in the bin folder:
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    
    cd "%~dp0\bin"
    keytool -keystore "C:\Program Files (x86)\Java\jre1.8.0_151\lib\security\cacerts" -storepass changeit -delete -alias DummyCompany
    jar.exe -cvf DeploymentRuleSet.jar ruleset.xml
    keytool -genkeypair -dname "cn=cnDummyCompany, ou=ouDummyCompany, o=oDummyCompany, c=EU" -alias DummyCompany -keypass Th!sH3lpsM3AL0t -keystore CA.jks -storepass Th!sH3lpsM3AL0t -validity 99999
    keytool -exportcert -keystore CA.jks -alias DummyCompany -file CA.cer -storepass Th!sH3lpsM3AL0t
    REN CA.cer CA.pem
    keytool -importcert -keystore "C:\Program Files (x86)\Java\jre1.8.0_151\lib\security\cacerts" -storepass changeit -file CA.pem -alias DummyCompany -noprompt
    jarsigner -verbose -keystore CA.jks -sigalg SHA256withDSA -signedjar DeploymentRuleSet.jar DeploymentRuleSet.jar DummyCompany -storepass Th!sH3lpsM3AL0t -tsa http://timestamp.digicert.com
    jarsigner -verify DeploymentRuleSet.jar
    copy DeploymentRuleSet.jar "C:\Windows\sun\java\deployment" /Y
  8. Create the following 2 files in C:\Windows\sun\java\deployment
    deployment.properties

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    
    deployment.javaws.autodownload.locked= 
    deployment.javaws.autodownload=NEVER
    deployment.expiration.check.enabled=false
    deployment.expiration.decision.suppression=true
    deployment.expiration.decision=NEVER
    deployment.insecure.jres=ALWAYS
    deployment.security.level.locked
    deployment.security.level=HIGH
    deployment.user.security.exception.sites=C\:\\Windows\\Sun\\Java\\Deployment\\exception.sites
    deployment.user.security.exception.sites.locked
    deployment.security.mixcode.locked
    deployment.security.mixcode=HIDE_RUN
    deployment.webjava.enabled.locked
    deployment.webjava.enabled=true

    deployment.config

    1
    2
    
    deployment.system.config=file\:C\:/WINDOWS/Sun/Java/Deployment/deployment.properties
    deployment.system.config.mandatory=false
  9. Open Java Console and check the installation:

    Valid DeploymentRuleset


    Certificate details

The vb-script

The vbscript checks if there is a working network connection. That is needed as the certificate needs to be validated. See my blog article Check if there is a working internet connection when a firewall blocks ping requests for more information.

The vbscripts.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
' ================================================================================================
' Installs Java certificates and installs deploymentruleset.jar
' Created by Willem-Jan Vroom
' Version history:
'
' 0.0.1
'  - Initial version
'
' 1.0.0
'  - Final version
'
' 1.0.1
'  - Checks if the folder %ProgramFiles%\Java\jre7 or %ProgramFiles(x86)%\Java\jre exits.
'    If not then quit.
'  - The file 'cacerts' will not be copied to the 'files_for_gpo' folder.
'
' 1.0.2
'  - Checks if run with elevated rights or admin rights
'  - Displays warnings on the screen (can be suppressed)
'  - Script cannot be run from a network share.
'
' 1.0.3
'  - Gets the installdir from the registry
'
' 1.0.4
'  - Output from the various commands to the log file. Useful for troubleshooting.
'
' Usuage:
'  - Create_and_install_Java_Certificates_v100.vbs
'    Creates the needed files in the default locations. Sufficient for a local installation
'
'  - Create_and_install_Java_Certificates_v100.vbs /remove
'    Removes the %windir%\Sun\java\development folder.
'
'  - Create_and_install_Java_Certificates_v100.vbs /gpo
'    Creates the files in the folder 'files_for_gpo'. These files can be copied to the users'
'    workstation.
'      
' ================================================================================================
 
' ------------------------------------------------------------------------------------------------
' Declare the most variables. 
' ------------------------------------------------------------------------------------------------
 
  Option Explicit
 
  Dim objShell                   : set objShell               = WScript.CreateObject("WScript.Shell")
  Dim objLogFileFSO              : Set objLogFileFSO          = CreateObject("Scripting.FileSystemObject")
  Dim objFSO                     : Set objFSO                 = CreateObject("Scripting.FileSystemObject")
  Dim objProcessEnv              : Set objProcessEnv          = objShell.Environment("PROCESS")
  Dim objWMIService              : Set objWMIService          = GetObject("winmgmts:\\.\root\cimv2")
  Dim fn_objWMIService           : Set fn_objWMIService       = GetObject("winmgmts:\\.\root\cimv2")
  Dim objReg                     : Set objReg                 = GetObject("winmgmts:\\.\root\default:StdRegProv")
  Dim objLogFile
  Dim CurrentDir                 : CurrentDir                 = Left(Wscript.ScriptFullname, InstrRev(Wscript.ScriptFullname, "\"))
                                   CurrentDir                 = Left(CurrentDir,len(CurrentDir)-1)
  Dim strcomputerName            : strcomputerName            = objProcessEnv("COMPUTERNAME")
  Dim strLogLocation             : strLogLocation             = "C:\WINDOWS\system32\Logfiles"
  Dim strOutputFile              : strOutputFile              = strLogLocation & "\" & strcomputerName & "_Installation_JavaCertificates_" & Replace(FormatDateTime(Now(), 2),"/","-") & ".log"
  Dim strArchitecture            : strArchitecture            = ""
  Dim strOS                      : strOS                      = ""
  Dim strCommand                 : strCommand                 = ""
  Dim strLine                    : strLine                    = ""
  Dim strQuery                   : strQuery                   = ""
  Dim strProgramFilesFolder      : strProgramFilesFolder      = ""
  Dim strExceptionSite           : strExceptionSite           = "" 
  Dim strErrorText               : strErrorText               = ""
  Dim strDeploymentRuleSetFolder : strDeploymentRuleSetFolder = objShell.ExpandEnvironmentStrings("%windir%") & "\sun\java\deployment"
  Dim strMemberOfGroups          : Set strMemberOfGroups      = objshell.Exec("whoami /groups")
  Dim MemberOfGroupsOutput       : Set MemberOfGroupsOutput   = strMemberOfGroups.StdOut
  Dim strMemberOfGroupsOutput    : strMemberOfGroupsOutput    = MemberOfGroupsOutput.ReadAll
  Dim bolPreReqPassed            : bolPreReqPassed            = True
  Dim strJavaExeFileVersion
  Dim strJarsignerExeFileVersion
  Dim strWebsite                 : strWebsite                 = "http://www.google.com"
 
  Dim colItems, objItem
  Dim valOSBuildNumber,valResult
  Dim arrArguments, valCounter
  Dim strKeyPath, strValueName, strValue, strCurrentVersion, strJavaHome
 
  Const ForWriting               = 2
  Const ForReading               = 1
  Const ForAppending             = 8
  Const OverWriteFiles           = True
  const HKEY_CURRENT_USER        = &H80000001
  const HKEY_LOCAL_MACHINE       = &H80000002
  Const HKEY_USERS               = &H80000003
  Const blnDebug                 = True
 
  Const strAlias                 = "DummyCompany"
  Const strPassword              = "changeit"
  Const strCN                    = "cnDummyCompany"
  Const strOU                    = "ouDummyCompany"
  Const strO                     = "oDummyCompany"
  Const strC                     = "EU"
 
  Const bolDisplayErrorsOnScreen = True
 
' ------------------------------------------------------------------------------------------------
' Checks if run with admin or elevated permissions. If not, then quit.
' ------------------------------------------------------------------------------------------------
 
  if InStr(strMemberOfGroupsOutput, "S-1-16-12288") = 0 AND InStr(strMemberOfGroupsOutput, "S-1-5-32-544") = 0 Then
     strErrorText = "You need to run this script with administrator or with elevated rights."
     ShowErrorOnScreen(strErrorText)
     wscript.quit(3)
  End if
 
' ------------------------------------------------------------------------------------------------
' Create the log location (if not exists)
' Open the logfile.  
' ------------------------------------------------------------------------------------------------
 
  CreateFolderStructure(strLogLocation)
  OpenLogFile()
  WriteToLog "- ACTION: script started."
 
' ------------------------------------------------------------------------------------------------
' Detect the current OS.  
' ------------------------------------------------------------------------------------------------
 
  Set colItems = objWMIService.ExecQuery("Select Caption,BuildNumber from Win32_OperatingSystem")
  For Each objItem in colItems
      strOS            = objItem.Caption
      valOSBuildNumber = objItem.BuildNumber
  next
 
' ------------------------------------------------------------------------------------------------
' Detect the current processor architecture.  
' ------------------------------------------------------------------------------------------------
 
  if objFSO.FolderExists(objShell.ExpandEnvironmentStrings("%windir%") & "\SysWOW64\Config") then  
     strArchitecture = "x64"
     strProgramFilesFolder=objProcessEnv("ProgramFiles(x86)")
       else
     strArchitecture = "x86"
     strProgramFilesFolder=objProcessEnv("ProgramFiles")
  end if
 
  WriteToLog("########## Details regarding operating system                        ##########")
  WriteToLog("Found Operating System:       " & strOS)
  WriteToLog("Found architecture:           " & strArchitecture)
  WriteToLog("########## End details regarding operating system                    ##########")
  WriteToLog(" ")
 
' ------------------------------------------------------------------------------------------------
' Sets SEE_MASK_NOZONECHECKS to 1.  
' That will avoid a screen that asks for permission to run an application from
' a share or mapped drive. 
' ------------------------------------------------------------------------------------------------
 
  objProcessEnv("SEE_MASK_NOZONECHECKS") = 1
 
' ------------------------------------------------------------------------------------------------
' Checks the prereqs:
'  - No UNC path
'  - Java Runtime Engine has been installed.
' ------------------------------------------------------------------------------------------------
 
  WriteToLog("########## Checking the pre-requirements                             ##########")
 
  if left(CurrentDir, 2) = "\\" Then
     strErrorText = "This script cannot run from an UNC path."
     WriteToLog (strErrorText)
     ShowErrorOnScreen(strErrorText)
     bolPreReqPassed  = false
  end if
 
  strKeyPath   = "SOFTWARE\JavaSoft\Java Runtime Environment"
  if strArchitecture = "x64" Then
     strKeyPath   = "SOFTWARE\Wow6432Node\JavaSoft\Java Runtime Environment"
  end if
 
  strValueName = "CurrentVersion"
  objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strCurrentVersion
  if isnull(strCurrentVersion) Then
     strErrorText = "There is no Java Runtime found."
     WriteToLog (strErrorText)
     ShowErrorOnScreen(strErrorText)
     bolPreReqPassed  = False
  end if
 
  if bolPreReqPassed Then
     strKeyPath   = strKeyPath & "\" & strCurrentVersion
     strValueName = "JavaHome" 
     objReg.GetStringValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,strJavaHome
  end if
 
  if bolPreReqPassed Then
     strJavaExeFileVersion      = objFSO.GetFileVersion(strJavaHome & "\bin\java.exe")
     strJarsignerExeFileVersion = objFSO.GetFileVersion(CurrentDir  & "\jarsigner.exe")
     WriteToLog("File version '" & strJavaHome & "\bin\java.exe' is: "& strJavaExeFileVersion)
     WriteToLog("File version '" & CurrentDir  & "\jarsigner.exe' is: "& strJarsignerExeFileVersion)
     if strJavaExeFileVersion = strJarsignerExeFileVersion Then
        WriteToLog("This is ok: the installation can continue.")
          else
        strErrorText = "The file versions are different. The installation is aborted now."
        WriteToLog (strErrorText)
        ShowErrorOnScreen(strErrorText)
        bolPreReqPassed  = False
     end if
  end if
 
  if bolPreReqPassed Then
     strCommand = "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -File " & chr(34) & CurrentDir & "\CheckIfWebsiteIsReachable_with_vbscript.ps1" & chr(34) & " -URL "& strWebsite
     valResult = objShell.Run(strCommand, 0, True)
     WriteToLog("The command '" & strCommand & "' returns " & valResult & ".")
     if valResult = 1 Then
        strErrorText = "The website '" & strWebsite & "' could not be reached. There is no working internet connection. The installation is aborted."
        WriteToLog (strErrorText)
        ShowErrorOnScreen(strErrorText)
        bolPreReqPassed  = False
     end if
  end if
 
  WriteToLog("########## End checking the pre-requirements                         ##########")   
 
  if NOT bolPreReqPassed Then
     CloseLogFile
     wscript.quit(2)
  end if
 
' ------------------------------------------------------------------------------------------------
' Sets the working directory
' ------------------------------------------------------------------------------------------------
 
  WriteToLog(" ")
  WriteToLog("Current working directory: " & objShell.CurrentDirectory)
  objShell.CurrentDirectory = CurrentDir
  WriteToLog("New working directory:     " & objShell.CurrentDirectory)
  WriteToLog(" ")
 
' ------------------------------------------------------------------------------------------------
' Checks for command line options
' ------------------------------------------------------------------------------------------------
 
  if wscript.arguments.count > 0 Then
     Set arrArguments = wscript.arguments
     for valCounter = 0 to wscript.arguments.count - 1
        if instr(lcase(arrArguments(valCounter)),"/remove") > 0 or instr(lcase(arrArguments(valCounter)),"/uninstall") > 0 Then
           DeleteDeploymentRuleSet
           CloseLogFile
           Wscript.quit(0)
        end if
        if instr(lcase(arrArguments(valCounter)),"/gpo") > 0 Then
           strDeploymentRuleSetFolder = CurrentDir & "\files_for_gpo"
           WriteToLog("*** The files will be generated for GPO Policy ***")
        end if
     next
  end if
 
' ------------------------------------------------------------------------------------------------
' Uninstall whatever version has already been installed. 
' ------------------------------------------------------------------------------------------------
 
  DeleteDeploymentRuleSet
 
' ------------------------------------------------------------------------------------------------
' Start the main application. 
' ------------------------------------------------------------------------------------------------
 
  WriteToLog("########## Start generating Java DeployementRuleSet.xml file.        ##########")
 
  DeleteFile(CurrentDir & "\CA.jks")
  DeleteFile(CurrentDir & "\CA.cer")
  DeleteFile(CurrentDir & "\CA.pem")
  DeleteFile(CurrentDir & "\DeploymentRuleSet.jar")
  fnKillProcess("javaw.exe")
 
  DeleteFile(strDeploymentRuleSetFolder & "\exception.sites")
 
  CreateDefaultExceptionSiteFile
 
  WriteToLog("Delete the current certificate with the alias: " & strAlias)
  strCommand = "keytool -keystore " & chr(34) & strJavaHome & "\lib\security\cacerts" & chr(34)
  strCommand = strCommand & " -storepass " & strPassword & " -delete -alias " & strAlias
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)
 
  WriteToLog("Create DeploymentRuleSet.jar from the ruleset.xml")
  strCommand = "jar.exe -cvf DeploymentRuleSet.jar ruleset.xml"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)
 
  WriteToLog("Create CA.jks certificate")
  strCommand = "keytool -genkeypair -dname " & chr(34) & "cn=" & strCN & ", ou=" & strOU & ", o=" & strO
  strCommand = strCommand & ", c=" & strC & chr(34) & " -alias " & strAlias
  strCommand = strCommand & " -keypass " & strPassword & " -keystore CA.jks -storepass " & strPassword & " -validity 99999"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)
 
  WriteToLog("Create CA.cer certificate")
  strCommand = "keytool -exportcert -keystore CA.jks -alias " & strAlias & " -file CA.cer -storepass " & strPassword
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)
 
  WriteToLog("Rename CA.cer to CA.pem")
  objFSO.CopyFile CurrentDir & "\CA.cer", currentDir & "\CA.pem"
  DeleteFile(CurrentDir & "\CA.cer")
 
  WriteToLog("Import CA.pem")
  strCommand = "keytool -importcert -keystore " & chr(34) & strJavaHome & "\lib\security\cacerts" & chr(34)
  strCommand = strCommand & " -storepass " & strPassword & " -file CA.pem -alias " & strAlias & " -noprompt"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)
 
  WriteToLog("Sign CA.jks")
  strCommand = "jarsigner -verbose -keystore CA.jks -sigalg SHA256withDSA -signedjar "
  strCommand = strCommand & "DeploymentRuleSet.jar DeploymentRuleSet.jar " & strAlias & " -storepass " & strPassword & " -tsa http://timestamp.digicert.com"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)
 
  WriteToLog("Sign DeploymentRuleSet.jar")
  strCommand = "jarsigner -verify -verbose DeploymentRuleSet.jar"
  if blnDebug Then
     WriteToLog("Running command: " & strCommand)
      else
     WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  End If
  RunCommandPlusOutput(strCommand)
 
  WriteToLog("Create the folder '" & strDeploymentRuleSetFolder & "' (if not already exists)") 
  CreateFolderStructure(strDeploymentRuleSetFolder)
 
  WriteToLog("Delete any existing 'DeploymentRuleSet.jar'")
  DeleteFile(strDeploymentRuleSetFolder & "\DeploymentRuleSet.jar")
 
  WriteToLog("Copy the new 'DeploymentRuleSet.jar' to '" & strDeploymentRuleSetFolder & "'.")
  objFSO.CopyFile CurrentDir & "\DeploymentRuleSet.jar", strDeploymentRuleSetFolder & "\"
  WriteToLog("########## End generating Java DeployementRuleSet.xml file.          ##########")
  WriteToLog(" ")
  WriteToLog("########## Copying deployment.config and deployment.properties.      ##########")
 
  objFSO.CopyFile CurrentDir & "\Main files\deployment.config"    , strDeploymentRuleSetFolder & "\" 
  objFSO.CopyFile CurrentDir & "\Main files\deployment.properties", strDeploymentRuleSetFolder & "\"
  objFSO.CopyFile CurrentDir & "\Main files\exception.sites"      , strDeploymentRuleSetFolder & "\"
 
  WriteToLog("########## End copying deployment.config and deployment.properties.  ##########")
 
  WriteToLog("########## Performing after installation checks.                     ##########")
 
  if fnAfterInstallationCheck Then
     WriteToLog("The deployment ruleset has been processed successfully.")
      else
     WriteToLog("There was an error while processing the deployment ruleset. The files where not copied to")
     WriteToLog("the folder '" & strDeploymentRuleSetFolder &"'.")
  end if
 
  WriteToLog("########## End performing after installation checks.                 ##########")
 
 
  CloseLogFile
 
Sub OpenLogFile() 
 
' ------------------------------------------------------------------------------------------------
' Subroutine: OpenLogFile() 
' The name of the logfile is mentinoed in the variabele strOutputFile.
' ------------------------------------------------------------------------------------------------
 
  If objLogFileFSO.FileExists(strOutputFile) Then
     Set objLogFile = objLogFileFSO.OpenTextFile(strOutputFile, ForWriting)
         Else
     Set objLogFile = objLogFileFSO.CreateTextFile(strOutputFile)
  End If
 
End Sub
 
Sub CloseLogFile()
 
' ------------------------------------------------------------------------------------------------
' Subroutine: CloseLogFile()
' Close the log file.
' ------------------------------------------------------------------------------------------------
 
  WriteToLog "- ACTION: script ended."
  objLogFile.Close
  Set objLogfileFSO = Nothing
 
End Sub
 
Function WriteToLog(sLogMessage)
 
' ------------------------------------------------------------------------------------------------
' Function: WriteToLog(sLogMessage)
' Writes an entry 'sLogMessage' in the logfile.
' ------------------------------------------------------------------------------------------------
 
  if instr(sLogMessage, "- ACTION: ") = 0 then sLogMessage = "          " & sLogMessage
  objLogFile.WriteLine("Time: " & now & "  " & sLogMessage)
 
End Function
 
Sub CreateFolderStructure(strFolderNameToBeCreated)
 
' ------------------------------------------------------------------------------------------------
' Subroutine: CreateFolderStructure(strFolderNameToBeCreated)
' Creates the map as mentioned in strFolderNameToBeCreated.
' ------------------------------------------------------------------------------------------------
 
  Dim arrFoldersTMP : arrFoldersTMP = split (strFolderNameToBeCreated,"\")
  Dim strFolder     : strFolder     = ""
  Dim objFolderTMP
 
  For Each objFolderTMP in arrFoldersTMP
      strFolder = strFolder & objFolderTMP
      If NOT objFSO.FolderExists(strFolder) Then
             objFSO.CreateFolder(strFolder)
      end If
      strFolder = strFolder & "\"
  Next
 
End Sub
 
Function RunCommandPlusOutput(strCommand)
 
' ------------------------------------------------------------------------------------------------
' Function: RunCommandPlusOutput(strCommand)
' Runs the command strCommand and returns the outpunt in RunCommandPlusOutput
' ------------------------------------------------------------------------------------------------
 
  Dim strResultsOfExecCommand          : Set strResultsOfExecCommand        = objshell.Exec(strCommand)
  Dim objResultsOfExecCommandOutput    : Set objResultsOfExecCommandOutput  = strResultsOfExecCommand.StdOut
  Dim strResultsOfExecCommandOutput    : strResultsOfExecCommandOutput      = objResultsOfExecCommandOutput.ReadAll
  strResultsOfExecCommandOutput = vbCrLf & vbCrLf & "---    Result of Running Comand ---   "& vbCrLf & strResultsOfExecCommandOutput
  strResultsOfExecCommandOutput = strResultsOfExecCommandOutput & "---  End result of running command --- " & vbCrLf
  WriteToLog (strResultsOfExecCommandOutput)
 
End Function
 
 
Function DeleteFile(strFileName)
 
' ------------------------------------------------------------------------------------------------
' Function: DeleteFile(strFileName)
' Deletes the given file
' ------------------------------------------------------------------------------------------------
 
  if objFSO.FileExists(strFileName) Then
     objFSO.DeleteFile(strFileName)
     WriteToLog("The file '" & strFileName & "' has been deleted.")
  end if
 
End Function 
 
Function fnKillProcess(strProcessName)
 
' ------------------------------------------------------------------------------------------------
' Function: fnKillProcess(strProcessName)
' Terminates the given processname.
' ------------------------------------------------------------------------------------------------
 
  Dim colProcess
  Dim objProcess
 
  Set colProcess = fn_objWMIService.ExecQuery ("Select * From Win32_Process")
  For Each objProcess In colProcess
    If Instr(LCase(objProcess.Name),LCase(strProcessName)) > 0 Then
       objShell.Run "TASKKILL /F /T /IM " & objProcess.Name, 0, False
       objProcess.Terminate()
       WriteToLog("Terminating application: " & objProcess.Name)
    End If
  Next
 
End Function
 
 
 
Sub CreateDefaultExceptionSiteFile
 
' ------------------------------------------------------------------------------------------------
' Subroutine: CreateDefaultExceptionSiteFile
' Create the default content for the exception.site file.
' ------------------------------------------------------------------------------------------------
 
  strExceptionSite = ""
 
End Sub
 
Sub DeleteDeploymentRuleSet
 
' ------------------------------------------------------------------------------------------------
' Subroutine: DeleteDeploymentRuleSet
' Deletes the folder %Windir%\sun\java\deployment
' ------------------------------------------------------------------------------------------------
 
  WriteToLog("########## Delete deploymentruleset from the system.                 ##########")
 
  if objFSO.FolderExists(strDeploymentRuleSetFolder) Then
     objFSO.DeleteFolder(strDeploymentRuleSetFolder)
     WriteToLog("The folder '" & strDeploymentRuleSetFolder & "' has been deleted successfully.")
  end if
 
  WriteToLog("Delete the current certificate with the alias: " & strAlias)
  strCommand = "keytool -keystore " & chr(34) & strJavaHome & "\lib\security\cacerts" & chr(34)
  strCommand = strCommand & " -storepass " & strPassword & " -delete -alias " & strAlias
  WriteToLog("Running command: " & Replace(strCommand, strPassword , "********"))
  RunCommandPlusOutput(strCommand)
 
  WriteToLog("########## End deleting deploymentruleset from the system.           ##########")
 
End Sub
 
Sub ShowErrorOnScreen(strErrorTextToShow)
 
' ------------------------------------------------------------------------------------------------
' Subroutine: ShowErrorOnScreen
' Shows an error message on the screen if allowd
' ------------------------------------------------------------------------------------------------
 
  if bolDisplayErrorsOnScreen Then
     msgbox strErrorTextToShow,16,"Error while creating and installing Java Certificate."
  end if
 
End Sub
 
Function fnAfterInstallationCheck
 
' ------------------------------------------------------------------------------------------------
' function: fnAfterInstallationCheck
' Checks if all files are in C:\Windows\Sun\Java\Deployment
' ------------------------------------------------------------------------------------------------
 
  fnAfterInstallationCheck = True
 
  if NOT objFSO.FileExists(strDeploymentRuleSetFolder & "\DeploymentRuleSet.jar") Then 
     writeToLog("### FATAL ERROR: The file '" & strDeploymentRuleSetFolder & "\DeploymentRuleSet.jar' does not exists!")
     fnAfterInstallationCheck = False
  End if
 
  if NOT objFSO.FileExists(strDeploymentRuleSetFolder & "\deployment.config") Then 
     writeToLog("### FATAL ERROR: The file '" & strDeploymentRuleSetFolder & "\deployment.config' does not exists!")
     fnAfterInstallationCheck = False
  End if
 
  if NOT objFSO.FileExists(strDeploymentRuleSetFolder & "\deployment.properties") Then 
     writeToLog("### FATAL ERROR: The file '" & strDeploymentRuleSetFolder & "\deployment.properties' does not exists!")
     fnAfterInstallationCheck = False
  End if
 
End Function

Group policy

If you run this script with the parameter /gpo then there will be a new folder created ‘files_for_gpo’. With a GPO setting, the files in that folder can be copied to %windir%\sun\java\deployment.
More information can be found in this article: Centralized Management of Java SE Environment Using GPO (Redux).

The screen prints below are created while following the guidelines in the above mentioned post.

Start Group Policy Management Console

Start Group Policy Management Console

Create new WMI query

Create new WMI query

Define the name

Define the name

Enter the query: Select * From win32_Directory where (name="c:\\Program Files\\Java\\jre7" or name="c:\\Program Files (x86)\\Java\\jre7")

Enter the query: Select * From win32_Directory where (name=”c:Program FilesJavajre7″ or name=”c:Program Files (x86)Javajre7″)

Click Save to save the query

Click Save to save the query

Specify the folder to be created

Specify the folder to be created

Specify the source and destination file

Specify the source and destination file

  • The source file will be:
    \\demoforest\sysvol\demoforest.local\JavaScripts\deployment.config
  • The destination file will be:
    %windir%\sun\java\deployment\deployment.config

Do the same for the other 3 files.

The same for all other files

The same for all other files

Apply the WMI filter to the GPO.

Apply the WMI filter to the GPO.

The files at the correct location on the client.

The files at the correct location on the client.

And the policy is also applied on the client.

And the policy is also applied on the client.

The whole package (excluding jre1.8.0_151.msi) can be downloaded here.

Permanent link to this article: https://www.vroom.cc/wordpress/oracle-java-ruleset-xml-and-signing-deploymentruleset-jar/